@ionivetech/mugiwara 0.6.5 → 0.7.0

package/dist/mugiwara.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { existsSync as existsSync7, readdirSync as readdirSync5, rmSync as rmSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join8, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { existsSync as existsSync12, readdirSync as readdirSync9, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { homedir as homedir4 } from "node:os";
+import { join as join15, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/args.ts
-var VALUE_FLAGS = { "--project": "project", "--target": "target" };
+var VALUE_FLAGS = { "--project": "project", "--target": "target", "--before": "before" };
 var BOOL_FLAGS = {
   "--global": "global",
   "--yes": "yes",
@@ -16,6 +17,8 @@ var BOOL_FLAGS = {
   "--dry-run": "dryRun",
   "--keep-logs": "keepLogs",
   "--check": "check",
+  "--all": "all",
+  "--verify": "verify",
   "--help": "help",
   "-h": "help",
   "--version": "version",
@@ -81,7 +84,7 @@ async function confirm(rl, question) {
 }
 
 // src/targets/claude.ts
-import { existsSync, mkdirSync, copyFileSync, chmodSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, copyFileSync, chmodSync, readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -119,6 +122,107 @@ function toolsFromScope(scope) {
     return "Read, Grep, Glob, Write, Bash, WebFetch, WebSearch";
   return;
 }
+var SCRIPTS_SRC = join(here, "..", "..", "scripts");
+function copyScripts(dstDir) {
+  if (!existsSync(SCRIPTS_SRC))
+    return [];
+  const written = [];
+  const copyDir = (src, dst) => {
+    if (!existsSync(src))
+      return;
+    for (const f of readdirSync(src)) {
+      if (!f.endsWith(".sh") || f === "install.sh")
+        continue;
+      const to = join(dst, f);
+      mkdirSync(dst, { recursive: true });
+      copyFileSync(join(src, f), to);
+      chmodSync(to, 493);
+      written.push(to);
+    }
+  };
+  copyDir(SCRIPTS_SRC, dstDir);
+  copyDir(join(SCRIPTS_SRC, "lib"), join(dstDir, "lib"));
+  return written;
+}
+function wireSettings(root, hooksDir) {
+  const file = join(root, "settings.json");
+  const events = {
+    SessionStart: { file: "session-start.js", timeout: 10 },
+    UserPromptSubmit: { file: "mugiwara-mode-tracker.js", timeout: 5 },
+    Stop: { file: "auto-savepoint.js", timeout: 20 },
+    SubagentStop: { file: "pipeline-guard.js", timeout: 15 },
+    PostToolUse: { file: "engagement-marker.js", timeout: 5, matcher: "Task|Skill" }
+  };
+  let settings = {};
+  if (existsSync(file)) {
+    try {
+      settings = JSON.parse(readFileSync(file, "utf8"));
+    } catch {
+      return { written: [], notes: [`${file} is not valid JSON — add the mugiwara hooks manually`] };
+    }
+  }
+  const hooks = settings.hooks ?? {};
+  let changed = false;
+  for (const [event, spec] of Object.entries(events)) {
+    const command = join(hooksDir, spec.file);
+    if (!existsSync(command))
+      continue;
+    const groups = Array.isArray(hooks[event]) ? hooks[event] : [];
+    const already = groups.some((g) => g.hooks?.some((h) => h.command?.includes(spec.file)));
+    if (already)
+      continue;
+    const group = { hooks: [{ type: "command", command: JSON.stringify(command), timeout: spec.timeout }] };
+    if (spec.matcher)
+      group.matcher = spec.matcher;
+    groups.push(group);
+    hooks[event] = groups;
+    changed = true;
+  }
+  if (!changed)
+    return { written: [], notes: [] };
+  settings.hooks = hooks;
+  writeFileSync(file, JSON.stringify(settings, null, 2) + `
+`);
+  return { written: [], notes: [`hooks registered in ${file}`] };
+}
+function unwireSettings(root) {
+  const file = join(root, "settings.json");
+  if (!existsSync(file))
+    return { changed: [], notes: [] };
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return { changed: [], notes: [`${file} is not valid JSON — left untouched`] };
+  }
+  const hooks = settings.hooks;
+  if (!hooks)
+    return { changed: [], notes: [] };
+  const ours = new Set(["session-start.js", "mugiwara-mode-tracker.js", "auto-savepoint.js", "pipeline-guard.js", "engagement-marker.js"]);
+  const isOurs = (h) => [...ours].some((f) => h.command?.includes(join("hooks", f)) || h.command?.includes(`hooks/${f}`));
+  let changed = false;
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups))
+      continue;
+    const kept = groups.map((g) => ({ ...g, hooks: (g.hooks ?? []).filter((h) => !isOurs(h)) })).filter((g) => g.hooks.length > 0);
+    if (kept.length !== groups.length || kept.some((g, i) => g.hooks.length !== groups[i]?.hooks?.length)) {
+      changed = true;
+    }
+    if (kept.length)
+      hooks[event] = kept;
+    else {
+      delete hooks[event];
+      changed = true;
+    }
+  }
+  if (!changed)
+    return { changed: [], notes: [] };
+  if (!Object.keys(hooks).length)
+    delete settings.hooks;
+  writeFileSync(file, JSON.stringify(settings, null, 2) + `
+`);
+  return { changed: [file], notes: [] };
+}
 var target = {
   id: "claude",
   label: "Claude Code",
@@ -157,7 +261,7 @@ var target = {
       return { written: [], notes: [] };
     if (existsSync(HOOKS_SRC)) {
       for (const f of readdirSync(HOOKS_SRC)) {
-        if (!f.endsWith(".ts"))
+        if (!/\.(ts|js|json)$/.test(f))
           continue;
         const dst = join(root, "hooks", f);
         if (!existsSync(dst)) {
@@ -167,6 +271,10 @@ var target = {
           written.push(dst);
         }
       }
+      written.push(...copyScripts(join(root, "scripts")));
+      const wired = wireSettings(root, join(root, "hooks"));
+      written.push(...wired.written);
+      notes.push(...wired.notes);
     }
     if (existsSync(COMMANDS_SRC)) {
       const dstDir = join(root, "commands");
@@ -184,6 +292,12 @@ var target = {
       }
     }
     return { written, notes };
+  },
+  postUninstall({ scope, projectDir, home, dryRun }) {
+    if (dryRun)
+      return { changed: [], notes: [] };
+    const root = scope === "global" ? join(home, ".claude") : join(projectDir, ".claude");
+    return unwireSettings(root);
   }
 };
 
@@ -208,8 +322,7 @@ var CREW = {
   "skeptic-verifier": { color: "#64748b", temperature: 0.1, steps: 12 },
   "eval-runner": { color: "#14b8a6", temperature: 0.2, steps: 15 },
   "resume-coordinator": { color: "#d97706", temperature: 0.2, steps: 10 },
-  "memory-keeper": { color: "#d946ef", temperature: 0.2, steps: 8 },
-  "onboarding-guide": { color: "#0ea5e9", temperature: 0.3, steps: 15 }
+  "memory-keeper": { color: "#d946ef", temperature: 0.2, steps: 8 }
 };
 function readBannerColors() {
   try {
@@ -319,7 +432,17 @@ var target3 = {
   transformSkill(data, body) {
     return {
       relPath: `${data.name}.instructions.md`,
-      text: stringifyFrontmatter({ description: data.description, applyTo: "**/*" }, body)
+      text: stringifyFrontmatter({ description: data.description, applyTo: "**/*" }, `# ${data.name}
+
+> ${data.description}
+
+Full skill: read \`.mugiwara/refs/${data.name}/${data.name}.md\` when the crew invokes this role.`)
+    };
+  },
+  transformSkillFull(data, body) {
+    return {
+      relPath: `${data.name}.md`,
+      text: stringifyFrontmatter({ description: data.description }, body)
     };
   },
   transformAgent(data, body) {
@@ -334,7 +457,7 @@ var target3 = {
 };
 
 // src/targets/generic.ts
-import { existsSync as existsSync3, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 function makeGeneric(opts) {
   const { id, label, rulesDir, bootstrapFile, bootstrapPointer, tier = bootstrapPointer ? 2 : 3 } = opts;
@@ -360,7 +483,7 @@ function makeGeneric(opts) {
 
 ## Skip when
 
-Full skill: \`${data.name}\` — read \`.mugiwara/refs/${data.name}.md\` when the crew invokes this role.`
+Full skill: \`${data.name}\` — read \`.mugiwara/refs/${data.name}/${data.name}.md\` when the crew invokes this role.`
         };
       }
       return { relPath: `${data.name}.md`, text: `# ${data.name}
@@ -386,7 +509,7 @@ ${body}` };
 
 > ${data.description}
 
-Skills: ${data.skills ?? ""}. Read \`.mugiwara/refs/${data.name}.md\` when embodying this role.
+Skills: ${data.skills ?? ""}. Read \`.mugiwara/refs/${data.name}/${data.name}.md\` when embodying this role.
 
 Only zoro-execution and brook-healing may modify source code.
 Return your output to luffy-orchestrator; do not choose the next step.`
@@ -411,8 +534,8 @@ Skills used: ${data.skills ?? ""}
 
 ${body}` };
     },
-    refsDir({ projectDir }) {
-      return join4(projectDir, ".mugiwara", "refs");
+    refsDir({ projectDir }, skillName) {
+      return join4(projectDir, ".mugiwara", "refs", skillName);
     },
     postInstall({ projectDir, dryRun }) {
       if (!bootstrapFile)
@@ -422,7 +545,7 @@ ${body}` };
       const file = join4(projectDir, bootstrapFile);
       if (!existsSync3(file)) {
         if (!dryRun)
-          writeFileSync(file, `${bootstrapPointer}
+          writeFileSync2(file, `${bootstrapPointer}
 `);
         written.push(file);
       } else {
@@ -497,7 +620,7 @@ var targets = { claude: target, opencode: target2, copilot: target3, gemini: tar
 var TARGET_IDS = Object.keys(targets);
 
 // src/installer.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync3, writeFileSync as writeFileSync2, copyFileSync as copyFileSync3, rmSync, lstatSync } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync3, writeFileSync as writeFileSync3, copyFileSync as copyFileSync3, rmSync, lstatSync } from "node:fs";
 import { dirname as dirname3, join as join5 } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -561,7 +684,7 @@ function installTo(target10, opts) {
     }
     if (!dryRun) {
       mkdirSync3(dirname3(absPath), { recursive: true });
-      writeFileSync2(absPath, text);
+      writeFileSync3(absPath, text);
     }
     result.written.push(absPath);
   };
@@ -610,6 +733,40 @@ function installTo(target10, opts) {
     result.written.push(...post.written);
     result.notes.push(...post.notes);
   }
+  if (scope === "project") {
+    const configPath = join5(projectDir, ".mugiwara", "config");
+    let configExists = false;
+    try {
+      configExists = lstatSync(configPath).isFile() || lstatSync(configPath).isSymbolicLink();
+    } catch {
+      configExists = false;
+    }
+    if (!configExists) {
+      const body = [
+        "mode=guided",
+        "branch=feature/{type}-{issue}-{slug}",
+        "commit=conventional",
+        "auto_commit=on",
+        "coverage_new=90",
+        "coverage_modified=80",
+        "review_depth=full",
+        "quality_depth=full",
+        "verify_merged=off",
+        "delegate_threshold=60",
+        "heal_max_cycles=3",
+        "verbosity=normal",
+        "# context_budget_chars=150000  # optional: fail archive if trail exceeds this (measured in report Cost section)"
+      ].join(`
+`) + `
+`;
+      if (!dryRun) {
+        mkdirSync3(dirname3(configPath), { recursive: true });
+        writeFileSync3(configPath, body);
+      }
+      result.written.push(configPath);
+      result.notes.push(`default config written: ${configPath} (edit it to customise)`);
+    }
+  }
   return result;
 }
 function removeInstalled(manifest, { dryRun = false } = {}) {
@@ -648,11 +805,11 @@ function assertNotSymlink(file) {
 }
 var GITIGNORE_BLOCK_START = "# >>> mugiwara >>>";
 var GITIGNORE_BLOCK_END = "# <<< mugiwara <<<";
-var GITIGNORE_MARKER = "# mugiwara";
-var GITIGNORE_BLOCK = `# >>> mugiwara >>> — audit trail is the product: commit reports/, results/, logs/, spec/, plans/.
-# Ignore session state and regenerated files.
-.mugiwara/state/
-.mugiwara/continue/
+var GITIGNORE_LEGACY = [".mugiwara/state/", "# mugiwara"];
+var GITIGNORE_BLOCK = `# >>> mugiwara >>> — audit trail is the product: commit plan.md, flows/, review.md,
+# decisions.md, blockers.md, report.md under .mugiwara/missions/. Ignore session state.
+.mugiwara/missions/**/*.json
+.mugiwara/index.md
 .mugiwara/config
 .mugiwara/refs/
 # <<< mugiwara <<<
@@ -663,10 +820,10 @@ function ensureProjectGitignore(projectDir, opts = {}) {
   assertNotSymlink(path);
   let existing = existsSync4(path) ? readFileSync3(path, "utf8") : "";
   if (existing) {
-    if (existing.includes(GITIGNORE_BLOCK_START) && existing.includes(".mugiwara/state/")) {
+    if (existing.includes(GITIGNORE_BLOCK_START) && existing.includes(".mugiwara/missions/**/*.json")) {
       return { appended: false, notes: [] };
     }
-    const hadOld = existing.includes(GITIGNORE_MARKER) || existing.includes(GITIGNORE_BLOCK_START);
+    const hadOld = GITIGNORE_LEGACY.some((m) => existing.includes(m)) || existing.includes(GITIGNORE_BLOCK_START);
     if (hadOld) {
       const clean = removeProjectGitignore(projectDir, { dryRun });
       existing = clean.removed ? existsSync4(path) ? readFileSync3(path, "utf8") : "" : existing;
@@ -677,7 +834,7 @@ function ensureProjectGitignore(projectDir, opts = {}) {
 ` : "";
   if (!dryRun) {
     mkdirSync3(dirname3(path), { recursive: true });
-    writeFileSync2(path, existing + separator + GITIGNORE_BLOCK);
+    writeFileSync3(path, existing + separator + GITIGNORE_BLOCK);
   }
   return { appended: true, notes: [`.gitignore ${dryRun ? "would upgrade+append" : "upgraded"} mugiwara audit-trail block`] };
 }
@@ -695,18 +852,20 @@ function removeProjectGitignore(projectDir, { dryRun = false } = {}) {
     if (end < start)
       return { removed: false, notes: ["delimiter mismatch — .gitignore left untouched"] };
     cleaned = current.slice(0, start) + current.slice(end + GITIGNORE_BLOCK_END.length);
-  } else if (current.includes(GITIGNORE_MARKER)) {
+  } else if (current.includes("# mugiwara")) {
     const LEGACY_LINES = new Set([
       ".mugiwara/state.json",
       ".mugiwara/state-*.json",
       ".mugiwara/config",
+      ".mugiwara/state/",
+      ".mugiwara/continue/",
       ".mugiwara/continue.md",
       ".mugiwara/refs/"
     ]);
     const lines = current.split(`
 `).filter((l) => {
       const t = l.trim();
-      if (t.startsWith(GITIGNORE_MARKER))
+      if (t.startsWith("# mugiwara"))
         return false;
       return !LEGACY_LINES.has(t);
     });
@@ -724,12 +883,12 @@ function removeProjectGitignore(projectDir, { dryRun = false } = {}) {
   if (cleaned === current)
     return { removed: false, notes: [] };
   if (!dryRun)
-    writeFileSync2(path, cleaned);
+    writeFileSync3(path, cleaned);
   return { removed: true, notes: [`.gitignore ${dryRun ? "would strip" : "stripped"} mugiwara block`] };
 }
 
 // src/manifest.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join6 } from "node:path";
 function manifestPath({ scope, projectDir, home }) {
   return scope === "global" ? join6(home, ".mugiwara", "manifest.json") : join6(projectDir, ".mugiwara", "manifest.json");
@@ -739,24 +898,441 @@ function readManifest(file) {
 }
 function writeManifest(file, data) {
   mkdirSync4(dirname4(file), { recursive: true });
-  writeFileSync3(file, JSON.stringify(data, null, 2) + `
+  writeFileSync4(file, JSON.stringify(data, null, 2) + `
+`);
+}
+
+// src/mission.ts
+import { existsSync as existsSync8, rmSync as rmSync2, readFileSync as readFileSync7, readdirSync as readdirSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync7, renameSync, openSync, writeSync, closeSync } from "node:fs";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { join as join11 } from "node:path";
+
+// src/integrity.ts
+import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync5 } from "node:fs";
+import { isAbsolute, join as join7, relative } from "node:path";
+var SECRET_PATTERNS = [
+  [/AKIA[0-9A-Z]{16}/, "AWS access key id"],
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "private key block"],
+  [/gh[pousr]_[A-Za-z0-9]{20,}/, "GitHub token"],
+  [/xox[baprs]-[A-Za-z0-9-]{10,}/, "Slack token"],
+  [/sk-[A-Za-z0-9]{32,}/, "API key (sk-…)"],
+  [/eyJhbGciOi[A-Za-z0-9_.-]{20,}/, "JWT pasted verbatim"],
+  [/(api[_-]?key|secret|passwd|password)\s*[=:]\s*["'][^"'\s]{8,}["']/i, "credential assignment"]
+];
+var ALLOW_SECRET = "mugiwara:allow-secret";
+function findSecrets(body) {
+  const out = [];
+  for (const line of body.split(/\r?\n/)) {
+    if (line.includes(ALLOW_SECRET))
+      continue;
+    for (const [re, label] of SECRET_PATTERNS) {
+      const hit = line.match(re);
+      if (hit)
+        out.push({ label, hit: hit[0] });
+    }
+  }
+  return out;
+}
+var TRAIL_EXTS = new Set([".md", ".json", ".sh"]);
+function trailFiles(dir) {
+  const out = [];
+  const walk = (d) => {
+    for (const e of readdirSync4(d, { withFileTypes: true })) {
+      const p = join7(d, e.name);
+      if (e.isDirectory())
+        walk(p);
+      else if (TRAIL_EXTS.has(e.name.slice(e.name.lastIndexOf(".")) || ""))
+        out.push(p);
+    }
+  };
+  walk(dir);
+  return out;
+}
+function linkedPaths(md) {
+  const out = [];
+  for (const m of md.matchAll(/\]\(([^)\s]+)\)/g)) {
+    const t = m[1];
+    if (/^(https?:|mailto:|#|\/\/)/.test(t))
+      continue;
+    out.push(t.split("#")[0]);
+  }
+  return out.filter(Boolean);
+}
+function hasCommandOutputShape(body) {
+  return /`[^`]+`/.test(body) || /\b(exit\s+[01]|✓|✗|\bPASS\b|\bFAIL\b|passed|failed|\d+\s+(passed|failed))\b/i.test(body);
+}
+function collectPassCitedPaths(missionDir) {
+  const out = [];
+  for (const f of trailFiles(missionDir)) {
+    let body;
+    try {
+      body = readFileSync5(f, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of body.split(/\r?\n/)) {
+      if (!/\bPASS\b/.test(line))
+        continue;
+      for (const p of linkedPaths(line))
+        out.push(p);
+      for (const m of line.matchAll(/(?:^|[\s"'(])([a-zA-Z0-9._\/-]+\.(?:md|txt|log|json))\b/g)) {
+        const cand = m[1];
+        if (cand.includes("/"))
+          out.push(cand);
+      }
+    }
+  }
+  return [...new Set(out)];
+}
+function checkTrail(missionDir, projectRoot) {
+  const issues = [];
+  const files = trailFiles(missionDir);
+  for (const f of files) {
+    let body;
+    try {
+      body = readFileSync5(f, "utf8");
+    } catch {
+      continue;
+    }
+    for (const target10 of linkedPaths(body)) {
+      if (isAbsolute(target10))
+        continue;
+      const fromMission = join7(missionDir, target10);
+      const fromRoot = join7(projectRoot, target10);
+      if (!existsSync6(fromMission) && !existsSync6(fromRoot)) {
+        issues.push({
+          kind: "dangling-path",
+          detail: `${relative(projectRoot, f)} links "${target10}" — no such file (mission dir or repo root)`
+        });
+      }
+    }
+    for (const { label, hit } of findSecrets(body)) {
+      issues.push({
+        kind: "secret",
+        detail: `${relative(projectRoot, f)} matches ${label}: ${hit.slice(0, 12)}…`
+      });
+    }
+  }
+  const evidencePaths = [];
+  const evidenceFile = join7(missionDir, "state.json");
+  if (existsSync6(evidenceFile)) {
+    try {
+      const s = JSON.parse(readFileSync5(evidenceFile, "utf8"));
+      if (Array.isArray(s.evidence)) {
+        for (const e of s.evidence) {
+          if (typeof e !== "string" || !e.trim())
+            continue;
+          evidencePaths.push(e);
+          const cand = join7(projectRoot, e);
+          if (!isAbsolute(e) && !existsSync6(cand) && !existsSync6(join7(missionDir, e))) {
+            issues.push({ kind: "evidence", detail: `state.json evidence "${e}" does not exist` });
+          }
+        }
+      }
+    } catch {}
+  }
+  const passCited = collectPassCitedPaths(missionDir);
+  for (const e of passCited) {
+    if (!e.trim() || isAbsolute(e))
+      continue;
+    const candMission = join7(missionDir, e);
+    const candRoot = join7(projectRoot, e);
+    const resolved = existsSync6(candMission) ? candMission : existsSync6(candRoot) ? candRoot : null;
+    if (!resolved)
+      continue;
+    let body;
+    try {
+      body = readFileSync5(resolved, "utf8");
+    } catch {
+      continue;
+    }
+    if (!hasCommandOutputShape(body)) {
+      issues.push({ kind: "evidence-thin", detail: `evidence "${e}" exists but lacks command output (no backticked command or exit-status token)` });
+    }
+  }
+  return issues;
+}
+function formatIssues(issues) {
+  return issues.map((i) => `  ✗ [${i.kind}] ${i.detail}`).join(`
 `);
 }
 
+// src/rollback.ts
+import { execFileSync } from "node:child_process";
+import { writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+function git(cwd, args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+}
+function buildRollback(input, commitsNewestFirst, filesTouched) {
+  const lines = [
+    "#!/usr/bin/env bash",
+    `# Rollback map for mission "${input.mission}" — generated at closure.`,
+    "# Human-executed. Review before running; mugiwara never runs this.",
+    `# Branch: ${input.branch}`,
+    `# Base:   ${input.baseSha}`,
+    "",
+    "set -euo pipefail",
+    ""
+  ];
+  if (!commitsNewestFirst.length && !filesTouched.length) {
+    lines.push("# No commits between base and HEAD on this branch — nothing to revert.", "");
+    return lines.join(`
+`);
+  }
+  if (!commitsNewestFirst.length) {
+    lines.push("# UNRESOLVED: squash-merged state detected.", `# git rev-list ${input.baseSha}..${input.branch} is empty, but the diff`, `# ${input.baseSha}..${input.branch} touches ${filesTouched.length} file(s):`, "# the mission's changes were collapsed into commit(s) already on the base", "# ref. No per-commit revert list can be derived automatically.", "# Locate the squash commit, review it, then revert it:", `#   git log --oneline ${input.baseSha}..HEAD --grep="${input.mission}"`, "#   git revert <squash-commit>", "# Files carrying the squashed changes (verify each after reverting):", ...filesTouched.map((f) => `#   ${f}`), "", 'echo "ROLLBACK INCOMPLETE: squash-merged state — locate and revert the squash commit manually" >&2', "exit 1", "");
+    return lines.join(`
+`);
+  }
+  lines.push("# Revert newest-first so earlier reverts never conflict with later ones.", "git revert --no-edit \\", commitsNewestFirst.map((c) => `  ${c}`).join(" \\\n"), "");
+  if (filesTouched.length) {
+    lines.push("# Files this mission touched (verify the working tree is clean afterwards):", ...filesTouched.map((f) => `#   ${f}`), "");
+  }
+  return lines.join(`
+`);
+}
+function generateRollback(projectDir, missionDir, input) {
+  try {
+    const range = `${input.baseSha}..${input.branch}`;
+    const revList = git(projectDir, ["rev-list", "--reverse", range]).split(/\r?\n/).filter(Boolean);
+    const commitsNewestFirst = [...revList].reverse();
+    const filesTouched = input.baseSha === "unknown" ? [] : git(projectDir, ["diff", "--name-only", input.baseSha, input.branch]).split(/\r?\n/).filter(Boolean);
+    const body = buildRollback(input, commitsNewestFirst, filesTouched);
+    const file = join8(missionDir, "rollback.sh");
+    writeFileSync5(file, body, { mode: 493 });
+    return { file: "rollback.sh", commits: commitsNewestFirst.length };
+  } catch {
+    return null;
+  }
+}
+
+// src/provenance.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join9 } from "node:path";
+function git2(cwd, args) {
+  return execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+}
+function modelLabel() {
+  return process.env.MUGIWARA_MODEL?.trim() || process.env.ANTHROPIC_MODEL?.trim() || "model-unrecorded (set MUGIWARA_MODEL to attribute)";
+}
+function buildNote(s) {
+  const gates = s.evidence.length ? s.evidence.join(" · ") : "no evidence recorded";
+  const uniqModels = [...new Set((s.models ?? []).filter(Boolean))];
+  const modelPart = uniqModels.length ? `model(s): ${uniqModels.join(", ")}` : s.model ?? modelLabel();
+  return [
+    `mission: ${s.mission}`,
+    `agent: ${s.actor || "unknown"} · ${modelPart} · lane ${s.lane} · mode ${s.mode}`,
+    `tasks: ${s.tasks_done}/${s.tasks_total}`,
+    `gates/evidence: ${gates}`,
+    `branch: ${s.branch}`,
+    "human review: pending (PR review is the terminal gate)"
+  ].join(`
+`);
+}
+function renderProvenanceMd(note, sha) {
+  const lines = [
+    "# Provenance",
+    "",
+    "<!-- paste below into the PR description or a PR comment -->",
+    "",
+    "```",
+    note,
+    "```",
+    "",
+    sha ? `Commit: ${sha}` : "Commit: not recorded (no git head resolved at closure)",
+    "",
+    "Query locally after pushing notes:",
+    "`git fetch origin refs/notes/mugiwara:refs/notes/mugiwara` then `mugiwara blame <path>`."
+  ];
+  return lines.join(`
+`) + `
+`;
+}
+function attachGitNote(projectDir, branch, note) {
+  try {
+    let sha;
+    try {
+      sha = git2(projectDir, ["rev-parse", "--verify", branch]);
+    } catch {
+      sha = git2(projectDir, ["rev-parse", "HEAD"]);
+    }
+    git2(projectDir, ["notes", "--ref=mugiwara", "add", "-f", "-m", note, sha]);
+    return { sha };
+  } catch {
+    return null;
+  }
+}
+function blamePath(projectDir, path) {
+  let sha;
+  try {
+    sha = git2(projectDir, ["log", "-1", "--format=%H", "--", path]);
+  } catch {
+    return `blame: not a git repository (${projectDir})`;
+  }
+  if (!sha)
+    return `blame: no commit touches "${path}"`;
+  try {
+    const note = git2(projectDir, ["notes", "--ref=mugiwara", "show", sha]);
+    return `${path} @ ${sha.slice(0, 7)}
+${note}`;
+  } catch {
+    return `${path} @ ${sha.slice(0, 7)}
+(no mugiwara provenance note on this commit)`;
+  }
+}
+function writeProvenance(projectDir, missionDir, state) {
+  const note = buildNote(state);
+  const attached = attachGitNote(projectDir, state.branch, note);
+  writeFileSync6(join9(missionDir, "provenance.md"), renderProvenanceMd(note, attached ? attached.sha : null));
+}
+
+// src/routing.ts
+var DOC_PAT = /\.(md|txt|rst)$|^docs\/|^(CHANGELOG|LICENSE|README)/;
+var TEST_PAT = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)(tests?|__tests__|specs?)\//;
+function scorePath(path, sensitivePaths, evidenceJoined) {
+  const reasons = [];
+  let score = 0;
+  const sensitiveHit = sensitivePaths.some((s) => s && (path === s || path.startsWith(s.replace(/\/?$/, "/")) || new RegExp(s.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*")).test(path)));
+  if (sensitiveHit) {
+    score += 100;
+    reasons.push("sensitive path");
+  }
+  if (!DOC_PAT.test(path) && !TEST_PAT.test(path)) {
+    score += 50;
+    reasons.push("production code");
+  } else if (TEST_PAT.test(path)) {
+    score += 10;
+    reasons.push("test scaffolding — skim unless behavior changed");
+  } else {
+    score += 5;
+    reasons.push("docs/config");
+  }
+  if (!evidenceJoined.includes(path)) {
+    score += 20;
+    reasons.push("not covered by recorded evidence");
+  }
+  return { score, reasons };
+}
+function rankFiles(paths, state) {
+  const sensitive = state.sensitive_paths ?? [];
+  const ev = state.evidence.join(" ");
+  return paths.map((path) => {
+    const { score, reasons } = scorePath(path, sensitive, ev);
+    return { path, score, reasons };
+  }).sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
+}
+function renderRouting(ranked, mission) {
+  if (!ranked.length)
+    return "";
+  const lines = [
+    "",
+    "## Review routing",
+    "",
+    `Ranked reading order for \`${mission}\` (heuristic ordering — it decides where to look first, never correctness):`,
+    ""
+  ];
+  ranked.forEach((r, i) => {
+    lines.push(`${i + 1}. \`${r.path}\` — ${r.reasons.join("; ")}`);
+  });
+  lines.push("");
+  return lines.join(`
+`);
+}
+
+// src/budget.ts
+import { existsSync as existsSync7, readdirSync as readdirSync5, readFileSync as readFileSync6, statSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join10 } from "node:path";
+function readBudgetConfig(projectDir) {
+  for (const base of [projectDir, homedir2()]) {
+    const file = join10(base, ".mugiwara", "config");
+    if (!existsSync7(file))
+      continue;
+    for (const line of readFileSync6(file, "utf8").split(/\r?\n/)) {
+      const t = line.trim();
+      if (!t || t.startsWith("#"))
+        continue;
+      const eq = t.indexOf("=");
+      if (eq === -1)
+        continue;
+      if (t.slice(0, eq).trim() !== "context_budget_chars")
+        continue;
+      const n = Number(t.slice(eq + 1).trim());
+      return Number.isFinite(n) && n > 0 ? n : 0;
+    }
+  }
+  return 0;
+}
+function measureContextChars(missionDir) {
+  let total = 0;
+  const add = (p) => {
+    try {
+      total += statSync(p).size;
+    } catch {}
+  };
+  for (const f of readdirSync5(missionDir)) {
+    if (/\.md$/.test(f))
+      add(join10(missionDir, f));
+  }
+  for (const sub of ["flows", "waves"]) {
+    const dir = join10(missionDir, sub);
+    if (existsSync7(dir)) {
+      for (const f of readdirSync5(dir))
+        add(join10(dir, f));
+    }
+  }
+  return total;
+}
+function formatFootprint(chars, budget) {
+  const base = `Context footprint: ${chars} chars`;
+  if (!budget)
+    return `${base} (no budget configured)`;
+  return chars > budget ? `${base} — OVER budget ${budget}` : `${base} (budget ${budget})`;
+}
+
 // src/mission.ts
-import { existsSync as existsSync6, rmSync as rmSync2, readFileSync as readFileSync5, readdirSync as readdirSync4, mkdirSync as mkdirSync5, appendFileSync } from "node:fs";
-import { join as join7 } from "node:path";
+function isStateFile(f) {
+  const stem = f.replace(/\.json$/, "");
+  return f.endsWith(".json") && stem !== "continue" && !stem.startsWith("continue-");
+}
+function primaryState(dir, files) {
+  const name = files.includes("state.json") ? "state.json" : files.find((f) => f.endsWith(".json") && f !== "continue.json" && !f.startsWith("continue-"));
+  if (!name)
+    return null;
+  try {
+    return JSON.parse(readFileSync7(join11(dir, name), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function changedFiles(projectDir, state) {
+  const base = typeof state?.base_sha === "string" ? state.base_sha : "";
+  const branch = typeof state?.branch === "string" ? state.branch : "";
+  if (!base || base === "unknown" || !branch)
+    return [];
+  try {
+    return execFileSync3("git", ["diff", "--name-only", base, branch], {
+      cwd: projectDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split(/\r?\n/).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
 function activeActor(projectDir) {
-  const stateDir = join7(projectDir, ".mugiwara", "state");
-  if (!existsSync6(stateDir))
+  const missionsDir = join11(projectDir, ".mugiwara", "missions");
+  if (!existsSync8(missionsDir))
     return null;
-  const missions = readdirSync4(stateDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  const missions = readdirSync6(missionsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   let latest = null;
   for (const mission of missions) {
-    const d = join7(stateDir, mission);
-    for (const f of readdirSync4(d).filter((f2) => f2.endsWith(".json"))) {
+    const d = join11(missionsDir, mission);
+    for (const f of readdirSync6(d).filter(isStateFile)) {
       try {
-        const s = JSON.parse(readFileSync5(join7(d, f), "utf8"));
+        const s = JSON.parse(readFileSync7(join11(d, f), "utf8"));
         const t = Date.parse(s.updated_at || "") || 0;
         if (!latest || t > latest.updated)
           latest = { actor: s.actor || null, updated: t };
@@ -766,8 +1342,8 @@ function activeActor(projectDir) {
   return latest ? latest.actor : null;
 }
 function resetMission(projectDir, keepLogs, force) {
-  const root = join7(projectDir, ".mugiwara");
-  if (!existsSync6(root))
+  const root = join11(projectDir, ".mugiwara");
+  if (!existsSync8(root))
     return { removed: [], kept: [] };
   if (!force) {
     const actor = activeActor(projectDir);
@@ -777,140 +1353,506 @@ function resetMission(projectDir, keepLogs, force) {
   }
   const removed = [];
   const kept = [];
-  for (const dir of ["spec", "plans", "results", "review", "issues", "reports"]) {
-    const p = join7(root, dir);
-    if (existsSync6(p)) {
-      rmSync2(p, { recursive: true, force: true });
-      removed.push(dir);
-    }
-  }
-  for (const dir of ["state", "continue"]) {
-    const p = join7(root, dir);
-    if (existsSync6(p)) {
+  for (const dir of ["missions", "spec", "plans", "results", "review", "issues", "reports", "state", "continue"]) {
+    const p = join11(root, dir);
+    if (existsSync8(p)) {
       rmSync2(p, { recursive: true, force: true });
       removed.push(dir);
     }
   }
-  for (const f of readdirSync4(root)) {
+  for (const f of readdirSync6(root)) {
     if (/^state(-.+)?\.json$/.test(f)) {
-      const p = join7(root, f);
-      if (existsSync6(p)) {
+      const p = join11(root, f);
+      if (existsSync8(p)) {
         rmSync2(p);
         removed.push(f);
       }
     }
   }
   if (!keepLogs) {
-    const p = join7(root, "logs");
-    if (existsSync6(p)) {
-      rmSync2(p, { recursive: true, force: true });
-      removed.push("logs");
+    for (const p of [join11(root, "lessons.md"), join11(root, "logs")]) {
+      if (existsSync8(p)) {
+        rmSync2(p, { recursive: true, force: true });
+        removed.push(p.startsWith(join11(root, "logs")) ? "logs" : "lessons.md");
+      }
     }
-  } else if (existsSync6(join7(root, "logs"))) {
-    kept.push("logs");
+  } else {
+    if (existsSync8(join11(root, "lessons.md")))
+      kept.push("lessons.md");
+    else if (existsSync8(join11(root, join11("logs", "lessons.md"))))
+      kept.push(join11("logs", "lessons.md"));
   }
   for (const f of ["config", "manifest.json", "backup"]) {
-    if (existsSync6(join7(root, f)))
+    if (existsSync8(join11(root, f)))
       kept.push(f);
   }
   return { removed, kept };
 }
 function archiveMission(projectDir, mission, opts = {}) {
   const { dryRun = false } = opts;
-  const root = join7(projectDir, ".mugiwara");
+  const root = join11(projectDir, ".mugiwara");
   if (!mission || /[^a-zA-Z0-9._-]/.test(mission) || /^\.+$/.test(mission))
     throw new Error(`invalid mission name "${mission}" (allowlist: [a-zA-Z0-9._-], not a dot-path)`);
   const removed = [];
   const kept = [];
-  const belongs = (f) => {
-    const base = f.replace(/^\d{4}-\d{2}-\d{2}-/, "");
-    return base === `${mission}.md` || base.startsWith(`${mission}-`);
-  };
-  let report = null;
-  const reportsDir = join7(root, "reports");
-  if (existsSync6(reportsDir)) {
-    const f = readdirSync4(reportsDir).find((n) => {
-      const m = n.match(/^(\d{4}-\d{2}-\d{2})-(.+)\.md$/);
-      return !!m && m[2] === mission;
-    });
-    if (f)
-      report = join7("reports", f);
-  }
-  const resultsDir = join7(root, "results", mission);
-  if (existsSync6(resultsDir)) {
-    for (const f of readdirSync4(resultsDir)) {
-      kept.push(join7("results", mission, f));
+  const dir = join11(root, "missions", mission);
+  if (!existsSync8(dir))
+    return { report: null, removed, kept };
+  if (!dryRun) {
+    const issues = checkTrail(dir, projectDir);
+    if (issues.length) {
+      throw new Error(`closure integrity gate failed — fix these before archiving:
+${formatIssues(issues)}`);
     }
   }
-  const specDir = join7(root, "spec");
-  if (existsSync6(specDir)) {
-    for (const f of readdirSync4(specDir)) {
-      if (!belongs(f))
-        continue;
-      const p = join7(specDir, f);
-      if (!dryRun)
-        rmSync2(p);
-      removed.push(join7("spec", f));
+  const files = readdirSync6(dir);
+  const state = primaryState(dir, files);
+  const stageModels = [...new Set(files.filter(isStateFile).map((f) => {
+    try {
+      const s = JSON.parse(readFileSync7(join11(dir, f), "utf8"));
+      return typeof s.model === "string" ? s.model : "";
+    } catch {
+      return "";
     }
-  }
-  for (const dir of ["review", "issues"]) {
-    const d = join7(root, dir);
-    if (!existsSync6(d))
-      continue;
-    for (const f of readdirSync4(d)) {
-      if (!belongs(f))
-        continue;
-      const p = join7(d, f);
-      if (!dryRun)
-        rmSync2(p, { force: true });
-      removed.push(join7(dir, f));
+  }).filter(Boolean))];
+  let costSection = "";
+  if (!dryRun && state) {
+    const chars = measureContextChars(dir);
+    const budget = readBudgetConfig(projectDir);
+    const footprintLine = formatFootprint(chars, budget);
+    if (budget && chars > budget) {
+      throw new Error(`closure context budget failed — ${footprintLine}. Trim the trail or raise context_budget_chars.`);
     }
-  }
-  const logsDir = join7(root, "logs");
-  if (existsSync6(logsDir)) {
-    for (const f of readdirSync4(logsDir)) {
-      if (!belongs(f))
-        continue;
-      const p = join7(logsDir, f);
-      if (!dryRun)
-        rmSync2(p);
-      removed.push(join7("logs", f));
+    const est = typeof state.tokens_est === "number" ? state.tokens_est : 0;
+    const src = typeof state.tokens_source === "string" ? state.tokens_source : "computed";
+    const lane = typeof state.lane === "string" ? state.lane : "unknown";
+    const laneBudget = lane === "lean" ? 12000 : lane === "standard" ? 25000 : lane === "full" ? 50000 : lane === "spike" ? 3000 : 0;
+    const effBudget = budget || laneBudget;
+    const pct = effBudget ? Math.round(est / effBudget * 100) : 0;
+    const delta = effBudget ? est <= effBudget ? `${(effBudget - est).toLocaleString()} under` : `${(est - effBudget).toLocaleString()} over` : "no budget configured";
+    const srcLabel = src === "reported" ? "provider-reported" : "estimator";
+    let reportedTotal = 0;
+    let hasReported = false;
+    for (const f of files.filter(isStateFile)) {
+      try {
+        const s = JSON.parse(readFileSync7(join11(dir, f), "utf8"));
+        if (s.tokens_source === "reported" && typeof s.tokens_est === "number") {
+          reportedTotal += s.tokens_est;
+          hasReported = true;
+        }
+      } catch {}
+    }
+    if (!hasReported && src === "reported" && est > 0) {
+      reportedTotal = est;
+      hasReported = true;
     }
+    costSection = [
+      "## Cost",
+      "",
+      "| Metric | Value |",
+      "|--------|-------|",
+      `| **Tokens used** | ${est.toLocaleString()} (${srcLabel}) |`,
+      `| **Lane** | ${lane} (budget ${effBudget ? effBudget.toLocaleString() : "—"} · warn ${effBudget ? Math.round(effBudget * 1.5).toLocaleString() : "—"} · stop ${effBudget ? (effBudget * 3).toLocaleString() : "—"}) |`,
+      `| **Budget status** | ${effBudget ? `${pct}% of budget · ${delta} · ${est >= effBudget * 3 ? "STOP" : est >= effBudget * 1.5 ? "WARN" : "OK"}` : "no lane budget"} |`,
+      `| **Context footprint** | ${chars.toLocaleString()} chars${budget ? ` (budget ${budget.toLocaleString()})` : " (no context budget configured)"} |`
+    ].join(`
+`);
+    if (hasReported) {
+      costSection += `
+| **Provider total** | ${reportedTotal.toLocaleString()} (provider-reported — sum of reported stages) |`;
+    }
+    costSection += `
+`;
   }
-  const contDir = join7(root, "continue", mission);
-  if (existsSync6(contDir)) {
-    if (!dryRun)
-      rmSync2(contDir, { recursive: true, force: true });
-    removed.push(join7("continue", mission));
+  const FOLD_TOP = ["decisions.md", "blockers.md", "review.md", "security.md", "spec.md"];
+  const fold = [];
+  for (const f of FOLD_TOP) {
+    if (files.includes(f))
+      fold.push(f);
   }
-  const stateDir = join7(root, "state", mission);
-  if (existsSync6(stateDir)) {
-    if (!dryRun)
-      rmSync2(stateDir, { recursive: true, force: true });
-    removed.push(join7("state", mission));
+  const flowsDir = join11(dir, "flows");
+  const legacyWavesDir = join11(dir, "waves");
+  const artDir = existsSync8(flowsDir) ? flowsDir : existsSync8(legacyWavesDir) ? legacyWavesDir : flowsDir;
+  const artRel = artDir === legacyWavesDir ? "waves" : "flows";
+  if (existsSync8(artDir)) {
+    for (const f of readdirSync6(artDir).sort())
+      fold.push(join11(artRel, f));
   }
-  if (report)
-    kept.push(report);
-  for (const k of ["plans", "config", join7("logs", "lessons.md")]) {
-    if (existsSync6(join7(root, k)))
-      kept.push(k);
+  let report = "";
+  const reportPath = join11(dir, "report.md");
+  if (files.includes("report.md"))
+    report = readFileSync7(reportPath, "utf8");
+  else if (existsSync8(join11(artDir, "06-closure.md")))
+    report = readFileSync7(join11(artDir, "06-closure.md"), "utf8");
+  if (!dryRun) {
+    mkdirSync5(dir, { recursive: true });
+    if (fold.length) {
+      const sections = fold.map((f) => {
+        const body = readFileSync7(join11(dir, f), "utf8").trim();
+        const name = f.includes("/") ? f.split("/").pop() ?? f : f;
+        return `
+
+## Archived: ${name}
+
+${body}`;
+      }).join("");
+      const tmp = `${reportPath}.tmp`;
+      const routingSection = state ? renderRouting(rankFiles(changedFiles(projectDir, state), {
+        mission,
+        evidence: Array.isArray(state.evidence) ? state.evidence : [],
+        sensitive_paths: Array.isArray(state.sensitive_paths) ? state.sensitive_paths : []
+      }), mission) : "";
+      writeFileSync7(tmp, report.trimEnd() + sections + (routingSection || "") + (costSection ? `
+${costSection}
+` : "") + `
+`);
+      renameSync(tmp, reportPath);
+    }
+    for (const f of fold) {
+      rmSync2(join11(dir, f), { force: true, recursive: true });
+      removed.push(join11("missions", mission, f));
+    }
+    for (const f of files.filter((f2) => f2.endsWith(".json")))
+      rmSync2(join11(dir, f), { force: true });
+    if (existsSync8(artDir) && readdirSync6(artDir).length === 0)
+      rmSync2(artDir, { recursive: true, force: true });
+    if (!existsSync8(reportPath)) {
+      writeFileSync7(reportPath, `# Mission: ${mission}
+
+Archived before closure — no wave artifacts were present.
+`);
+    }
+    if (state && typeof state.branch === "string") {
+      const rb = generateRollback(projectDir, dir, {
+        mission,
+        branch: state.branch,
+        baseSha: typeof state.base_sha === "string" ? state.base_sha : "unknown"
+      });
+      if (rb)
+        kept.push(join11("missions", mission, rb.file));
+      try {
+        writeProvenance(projectDir, dir, {
+          mission,
+          actor: typeof state.actor === "string" ? state.actor : "",
+          lane: typeof state.lane === "string" ? state.lane : "",
+          mode: typeof state.mode === "string" ? state.mode : "",
+          branch: state.branch,
+          tasks_done: Number(state.tasks_done) || 0,
+          tasks_total: Number(state.tasks_total) || 0,
+          evidence: Array.isArray(state.evidence) ? state.evidence : [],
+          models: stageModels
+        });
+        kept.push(join11("missions", mission, "provenance.md"));
+      } catch {}
+    }
+  } else {
+    for (const f of fold)
+      removed.push(join11("missions", mission, f));
   }
+  removed.push(join11("missions", mission, "<session state>"));
+  if (files.includes("plan.md"))
+    kept.push(join11("missions", mission, "plan.md"));
+  if (files.includes("handoff.md"))
+    kept.push(join11("missions", mission, "handoff.md"));
+  kept.push(join11("missions", mission, "report.md"));
   let index;
-  const indexFile = join7(root, "reports", "index.md");
-  const line = `- ${mission} — ${new Date().toISOString().slice(0, 10)}${report ? ` → ${report}` : ""}
+  const indexFile = join11(root, "index.md");
+  const line = `- ${mission} — ${new Date().toISOString().slice(0, 10)}
 `;
   if (!dryRun) {
-    mkdirSync5(join7(root, "reports"), { recursive: true });
-    const existing = existsSync6(indexFile) ? readFileSync5(indexFile, "utf8") : "";
+    const existing = existsSync8(indexFile) ? readFileSync7(indexFile, "utf8") : "";
     if (!existing.split(/\r?\n/).some((l) => l.startsWith(`- ${mission} —`))) {
       const header = existing ? "" : `# Mission index
 
 `;
-      appendFileSync(indexFile, header + line);
+      const fd = openSync(indexFile, "a");
+      try {
+        writeSync(fd, header + line);
+      } finally {
+        closeSync(fd);
+      }
+    }
+    index = "index.md";
+  }
+  return { report: join11("missions", mission, "report.md"), removed, kept, index };
+}
+
+// src/run.ts
+import { existsSync as existsSync9, readdirSync as readdirSync7 } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { dirname as dirname5, join as join12, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+var here3 = dirname5(fileURLToPath4(import.meta.url));
+var SCRIPTS_DIR = join12(here3, "..", "scripts");
+var RUNNABLE = ["savepoint.sh", "lane.sh"];
+function findBash() {
+  const explicit = process.env.MUGIWARA_BASH?.trim();
+  if (explicit)
+    return existsSync9(explicit) ? explicit : null;
+  const candidates = process.platform === "win32" ? [
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+    "C:\\Program Files (x86)\\Git\\bin\\bash.exe",
+    join12(process.env.LOCALAPPDATA ?? "", "Programs", "Git", "bin", "bash.exe")
+  ] : ["/bin/bash", "/usr/bin/bash", "/usr/local/bin/bash", "/opt/homebrew/bin/bash"];
+  for (const p of candidates) {
+    if (p && existsSync9(p))
+      return p;
+  }
+  const probe = spawnSync(process.platform === "win32" ? "where" : "which", ["bash"], {
+    encoding: "utf8"
+  });
+  const first = probe.stdout?.split(/\r?\n/).find((l) => l.trim());
+  return first?.trim() || null;
+}
+function noBashMessage() {
+  const remedy = process.platform === "win32" ? "Install Git for Windows (which ships bash)" : "Install bash with your package manager (e.g. `apk add bash`, `apt install bash`)";
+  return `no bash found. ${remedy}, or set MUGIWARA_BASH to a bash executable.`;
+}
+function runScript(name, args, projectDir) {
+  if (!/^[a-z0-9-]+\.sh$/.test(name)) {
+    throw new Error(`invalid script name "${name}" (expected one of: ${RUNNABLE.join(", ")})`);
+  }
+  const script = join12(SCRIPTS_DIR, name);
+  if (!existsSync9(script)) {
+    const have = existsSync9(SCRIPTS_DIR) ? readdirSync7(SCRIPTS_DIR).filter((f) => f.endsWith(".sh")) : [];
+    throw new Error(`script not found: ${name}${have.length ? ` (available: ${have.join(", ")})` : ""}`);
+  }
+  const bash = findBash();
+  if (!bash)
+    throw new Error(noBashMessage());
+  const r = spawnSync(bash, [script, ...args], {
+    cwd: resolve(projectDir),
+    stdio: "inherit",
+    env: process.env
+  });
+  if (r.error)
+    throw r.error;
+  return r.status ?? 1;
+}
+
+// src/continue.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync8 } from "node:fs";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { join as join13 } from "node:path";
+var SAFE = /^[A-Za-z0-9._-]+$/;
+var isSafeKey = (s) => SAFE.test(s) && !/^\.+$/.test(s);
+var num = (v) => {
+  const n = Number(v);
+  return Number.isFinite(n) ? n : 0;
+};
+var text = (v) => typeof v === "string" ? v : "";
+function gitActor(cwd) {
+  const env = (process.env.STATE_ACTOR ?? "").trim();
+  if (env)
+    return env;
+  const author = (process.env.GIT_AUTHOR_NAME ?? "").trim();
+  if (author)
+    return author;
+  const git3 = (args) => {
+    try {
+      return execFileSync4("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch {
+      return "";
+    }
+  };
+  const name = git3(["config", "user.name"]);
+  const email = git3(["config", "user.email"]);
+  if (name && email)
+    return `${name} <${email}>`;
+  return name || process.env.USER || process.env.USERNAME || "";
+}
+function scan(projectDir, kind, map) {
+  const base = join13(projectDir, ".mugiwara", "missions");
+  if (!existsSync10(base))
+    return [];
+  const out = [];
+  const missions = readdirSync8(base, { withFileTypes: true }).filter((e) => e.isDirectory() && isSafeKey(e.name)).map((e) => e.name).sort();
+  for (const mission of missions) {
+    const dir = join13(base, mission);
+    for (const f of readdirSync8(dir).filter((n) => n.endsWith(".json")).sort()) {
+      const stem = f.slice(0, -".json".length);
+      let member;
+      if (kind === "state") {
+        if (stem === "continue" || stem.startsWith("continue-"))
+          continue;
+        member = stem === "state" ? null : stem;
+      } else {
+        if (stem === "continue")
+          member = null;
+        else if (stem.startsWith("continue-"))
+          member = stem.slice("continue-".length);
+        else
+          continue;
+      }
+      if (member !== null && !isSafeKey(member))
+        continue;
+      try {
+        const raw = JSON.parse(readFileSync8(join13(dir, f), "utf8"));
+        if (text(raw.mission) !== mission)
+          continue;
+        out.push(map(raw, member));
+      } catch {}
     }
-    index = join7("reports", "index.md");
   }
-  return { report, removed, kept, index };
+  return out;
+}
+function readContinue(projectDir) {
+  return scan(projectDir, "continue", (r, member) => ({
+    mission: text(r.mission),
+    member,
+    actor: text(r.actor),
+    branch: text(r.branch),
+    flow: num(r.flow ?? r.wave),
+    mode: text(r.mode) || "guided",
+    tasks_done: num(r.tasks_done),
+    tasks_total: num(r.tasks_total),
+    lane: text(r.lane) || "direct",
+    next_action: text(r.next_action),
+    next_session_prompt: text(r.next_session_prompt),
+    updated_at: text(r.updated_at)
+  }));
+}
+function readState(projectDir) {
+  return scan(projectDir, "state", (r, member) => {
+    const tasks = r.tasks ?? {};
+    return {
+      mission: text(r.mission),
+      member,
+      actor: text(r.actor),
+      branch: text(r.branch),
+      flow: num(r.flow ?? r.wave),
+      mode: text(r.mode) || "guided",
+      tasks_done: num(tasks.done),
+      tasks_total: num(tasks.total),
+      lane: text(r.lane) || "direct",
+      lane_reason: text(r.lane_reason),
+      lane_rose: r.lane_rose === true,
+      lane_prev: text(r.lane_prev),
+      lane_peak: text(r.lane_peak),
+      base_sha: text(r.base_sha),
+      sensitive_paths: Array.isArray(r.sensitive_paths) ? r.sensitive_paths.map(text).filter(Boolean) : [],
+      next_action: text(r.next_action),
+      next_session_prompt: text(r.next_session_prompt),
+      updated_at: text(r.updated_at),
+      blockers_open: num(r.blockers_open),
+      heal_cycle: num(r.heal_cycle),
+      heal_max_cycles: num(r.heal_max_cycles) || 3,
+      heal_halt: r.heal_halt === true,
+      delegate_threshold: num(r.delegate_threshold) || 60,
+      delegate_due: r.delegate_due === true,
+      tokens_est: num(r.tokens_est),
+      budget: num(r.budget),
+      budget_status: text(r.budget_status) || "ok",
+      files_touched: num(r.files_touched),
+      evidence: Array.isArray(r.evidence) ? r.evidence.map(text).filter(Boolean) : []
+    };
+  });
+}
+function resolveContinue(entries, mission, member) {
+  if (!entries.length)
+    return { kind: "none" };
+  if (!mission) {
+    const missions = [...new Set(entries.map((e) => e.mission))];
+    if (missions.length === 1)
+      return resolveContinue(entries, missions[0], member);
+    return { kind: "missions", entries };
+  }
+  const inMission = entries.filter((e) => e.mission === mission);
+  if (!inMission.length) {
+    return { kind: "unknown-mission", mission, known: [...new Set(entries.map((e) => e.mission))] };
+  }
+  if (member) {
+    const hit = inMission.find((e) => e.member === member);
+    if (!hit) {
+      return {
+        kind: "unknown-member",
+        mission,
+        member,
+        known: inMission.map((e) => e.member ?? "(solo)")
+      };
+    }
+    return { kind: "resume", entry: hit };
+  }
+  const solo = inMission.find((e) => e.member === null);
+  if (solo && inMission.length === 1)
+    return { kind: "resume", entry: solo };
+  return { kind: "members", mission, entries: inMission };
+}
+function pad(s, n) {
+  return s.length >= n ? s : s + " ".repeat(n - s.length);
+}
+function formatTable(entries) {
+  const rows = entries.map((e) => [
+    e.mission,
+    e.member ?? "—",
+    String(e.flow),
+    `${e.tasks_done}/${e.tasks_total}`,
+    e.lane,
+    e.mode
+  ]);
+  const head = ["MISSION", "MEMBER", "FLOW", "TASKS", "LANE", "MODE"];
+  const widths = head.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const line = (cells) => "  " + cells.map((c, i) => pad(c, widths[i])).join("  ").trimEnd();
+  return [line(head), ...rows.map(line)].join(`
+`);
+}
+function formatResume(e) {
+  const scope = e.member ? ` [${e.member}]` : "";
+  const next = e.next_session_prompt || "(no next_session_prompt recorded)";
+  return `Resumed: ${e.mission}${scope}, Flow ${e.flow}, ${e.tasks_done}/${e.tasks_total} tasks — next_action: ${e.next_action} — run: ${next}`;
+}
+
+// src/sign.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join14 } from "node:path";
+function signArgs(reportPath, secretKey) {
+  return ["-Sm", reportPath, "-s", secretKey];
+}
+function verifyArgs(reportPath, pubKey) {
+  return pubKey ? ["-Vm", reportPath, "-p", pubKey] : ["-Vm", reportPath];
+}
+function hasMinisign() {
+  try {
+    execFileSync5("minisign", ["-v"], { stdio: ["ignore", "pipe", "ignore"] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function defaultKey(flag) {
+  return join14(homedir3(), ".mugiwara", flag === "secret" ? "minisign.key" : "minisign.pub");
+}
+function signReport(projectDir, missionDir) {
+  const report = join14(missionDir, "report.md");
+  if (!existsSync11(report))
+    return { ok: false, message: "no report.md to sign — archive first" };
+  if (!hasMinisign()) {
+    return { ok: false, message: "minisign not installed — signing skipped (install minisign to enable attestation)" };
+  }
+  const secretKey = process.env.MUGIWARA_SIGN_KEY?.trim() || defaultKey("secret");
+  try {
+    execFileSync5("minisign", signArgs(report, secretKey), { cwd: projectDir, stdio: "pipe", input: process.env.MUGIWARA_SIGN_PASSWORD ?? "" });
+    return { ok: true, message: `signed ${report}.minisig (key: ${secretKey})` };
+  } catch (e) {
+    return { ok: false, message: `signing failed: ${e.message}` };
+  }
+}
+function verifyReport(projectDir, missionDir) {
+  const report = join14(missionDir, "report.md");
+  const sig = `${report}.minisig`;
+  if (!existsSync11(sig))
+    return { ok: false, message: "not signed (no .minisig beside report.md)" };
+  if (!hasMinisign())
+    return { ok: false, message: "minisign not installed — cannot verify" };
+  const pubKey = existsSync11(defaultKey("public")) ? defaultKey("public") : null;
+  try {
+    execFileSync5("minisign", verifyArgs(report, pubKey), { cwd: projectDir, stdio: "pipe" });
+    return { ok: true, message: "signature verifies against report.md" };
+  } catch {
+    return { ok: false, message: "SIGNATURE INVALID — report.md changed after signing" };
+  }
 }
 
 // src/cli.ts
@@ -937,12 +1879,28 @@ async function run(argv) {
       return resetCmd(flags);
     case "archive":
       return archive(flags, _);
+    case "clean":
+      return cleanCmd(flags);
+    case "continue":
+      return continueCmd(flags, _);
+    case "status":
+      return statusCmd(flags);
+    case "run":
+      return runCmd(flags, _);
+    case "savepoint":
+      return runCmd(flags, ["run", "savepoint.sh", ..._.slice(1)]);
+    case "blame":
+      return blameCmd(flags, _);
+    case "handoff":
+      return handoffCmd(flags, _);
+    case "sign":
+      return signCmd(flags, _);
     default:
       throw new Error(`Unknown command: ${command}`);
   }
 }
 function resetCmd(flags) {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
   const force = flag(flags.force);
   const result = resetMission(projectDir, flag(flags.keepLogs), force);
   if (result.blocked) {
@@ -957,7 +1915,7 @@ function resetCmd(flags) {
     console.log(`kept: ${result.kept.join(", ")}`);
 }
 function archive(flags, positionals) {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
   const mission = positionals[1];
   if (!mission) {
     console.error("usage: mugiwara archive <mission> [--project <dir>] [--dry-run]");
@@ -966,6 +1924,8 @@ function archive(flags, positionals) {
   const result = archiveMission(projectDir, mission, { dryRun: flag(flags.dryRun) });
   if (result.report)
     console.log(`archive target: ${result.report}`);
+  else
+    console.error(`no mission dir for "${mission}" under .mugiwara/missions/`);
   if (result.removed.length)
     console.log(`${flag(flags.dryRun) ? "would remove" : "removed"}: ${result.removed.join(", ")}`);
   if (result.kept.length)
@@ -973,6 +1933,60 @@ function archive(flags, positionals) {
   if (result.index)
     console.log(`index updated: ${result.index}`);
 }
+function cleanCmd(flags) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const dryRun = flag(flags.dryRun);
+  const root = join15(projectDir, ".mugiwara", "missions");
+  if (!existsSync12(root)) {
+    console.log("nothing to clean (.mugiwara/missions/ does not exist).");
+    return;
+  }
+  const before = str(flags.before);
+  const beforeMs = before ? Date.parse(before) : NaN;
+  if (before && !Number.isFinite(beforeMs)) {
+    console.error(`invalid --before date: ${before}`);
+    process.exit(1);
+  }
+  let candidates = readdirSync9(root, { withFileTypes: true }).filter((e) => e.isDirectory() && /^[A-Za-z0-9._-]+$/.test(e.name) && !/^\.+$/.test(e.name)).map((e) => e.name);
+  const stateFiles = (m) => readdirSync9(join15(root, m)).filter((f) => {
+    const stem = f.replace(/\.json$/, "");
+    return f.endsWith(".json") && stem !== "continue" && !stem.startsWith("continue-");
+  });
+  const hasLiveState = (m) => stateFiles(m).length > 0;
+  const staleBefore = (m) => {
+    if (!Number.isFinite(beforeMs))
+      return false;
+    for (const f of stateFiles(m)) {
+      try {
+        const ts = Date.parse(JSON.parse(readFileSync9(join15(root, m, f), "utf8")).updated_at ?? "") || 0;
+        if (ts === 0 || ts >= beforeMs)
+          return false;
+      } catch {
+        return false;
+      }
+    }
+    return true;
+  };
+  if (!flag(flags.all)) {
+    candidates = candidates.filter((m) => existsSync12(join15(root, m, "report.md")) && !hasLiveState(m) || staleBefore(m));
+  } else if (!flag(flags.force)) {
+    const live = candidates.filter((m) => hasLiveState(m) && !staleBefore(m));
+    if (live.length) {
+      console.error(`✗ in-flight mission(s): ${live.join(", ")}. Use --force to archive them anyway.`);
+      process.exit(1);
+    }
+  }
+  if (!candidates.length) {
+    console.log("nothing to clean.");
+    return;
+  }
+  for (const m of candidates) {
+    const r = archiveMission(projectDir, m, { dryRun });
+    console.log(`${dryRun ? "would clean" : "cleaned"} ${m}${r.report ? ` → ${r.report}` : ""}`);
+    if (r.index)
+      console.log(`index updated: ${r.index}`);
+  }
+}
 async function resolveOptions(flags) {
   const interactive = !flag(flags.yes);
   if (interactive && !process.stdin.isTTY) {
@@ -987,8 +2001,8 @@ async function resolveOptions(flags) {
       } else
         scope = await choose(rl, "Install scope?", ["global (user-wide)", "project (this repo)"]) === 0 ? "global" : "project";
     }
-    const projectDir = resolve(str(flags.project) ?? process.cwd());
-    if (scope === "project" && !existsSync7(projectDir))
+    const projectDir = resolve2(str(flags.project) ?? process.cwd());
+    if (scope === "project" && !existsSync12(projectDir))
       throw new Error(`Project dir not found: ${projectDir}`);
     let targetIds = str(flags.target)?.split(",").map((s) => s.trim()) ?? null;
     if (targetIds && targetIds.includes("all"))
@@ -1013,7 +2027,7 @@ async function resolveOptions(flags) {
 }
 async function install(flags) {
   const { scope, projectDir, targetIds } = await resolveOptions(flags);
-  const home = homedir2();
+  const home = homedir4();
   const allFiles = [];
   const allNotes = [];
   const installed = [];
@@ -1055,17 +2069,19 @@ Dry run — nothing written.`);
 OK mugiwara ${VERSION} installed (manifest: ${file})`);
   if (allNotes.length)
     console.log(`${allNotes.length} note(s) above may need attention.`);
+  console.log(`
+Next: edit .mugiwara/config to customise (mode, branch, coverage, depths).`);
 }
 async function uninstall(flags) {
   const scope = flag(flags.global) ? "global" : "project";
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
-  const home = homedir2();
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const home = homedir4();
   const file = manifestPath({ scope, projectDir, home });
   const manifest = readManifest(file);
   if (!manifest) {
     if (scope === "project") {
       const globalFile = manifestPath({ scope: "global", projectDir, home });
-      if (existsSync7(globalFile)) {
+      if (existsSync12(globalFile)) {
         console.log(`No project manifest found, but a global install exists. Try:
   mugiwara uninstall --global`);
         return;
@@ -1085,6 +2101,16 @@ async function uninstall(flags) {
     }
   }
   const removed = removeInstalled(manifest, { dryRun: flag(flags.dryRun) });
+  for (const id of manifest.targets) {
+    const t = targets[id];
+    if (!t?.postUninstall)
+      continue;
+    const post = t.postUninstall({ scope, projectDir, home, dryRun: flag(flags.dryRun) });
+    for (const f of post.changed)
+      console.log(`   unwired mugiwara hooks from ${f}`);
+    for (const n of post.notes)
+      console.log(`   note: ${n}`);
+  }
   if (!flag(flags.dryRun)) {
     if (scope === "project") {
       const gi = removeProjectGitignore(projectDir);
@@ -1092,13 +2118,13 @@ async function uninstall(flags) {
         console.log(`   note: ${n}`);
     }
     rmSync3(file);
-    const mugiDir = join8(scope === "global" ? home : projectDir, ".mugiwara");
-    if (existsSync7(mugiDir) && readdirSync5(mugiDir).length === 0) {
+    const mugiDir = join15(scope === "global" ? home : projectDir, ".mugiwara");
+    if (existsSync12(mugiDir) && readdirSync9(mugiDir).length === 0) {
       rmSync3(mugiDir, { recursive: true, force: true });
     }
     if (manifest.targets.includes("opencode")) {
-      const opencodeCache = join8(home, ".cache", "opencode", "packages", "@ionivetech");
-      if (existsSync7(opencodeCache)) {
+      const opencodeCache = join15(home, ".cache", "opencode", "packages", "@ionivetech");
+      if (existsSync12(opencodeCache)) {
         rmSync3(opencodeCache, { recursive: true, force: true });
         console.log("   cleared opencode npm cache (stale plugin versions)");
       }
@@ -1107,8 +2133,8 @@ async function uninstall(flags) {
   console.log(`OK removed ${removed.length} files`);
 }
 function list(flags) {
-  const home = homedir2();
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const home = homedir4();
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
   let found = false;
   for (const [label, file] of [
     ["project", manifestPath({ scope: "project", projectDir, home })],
@@ -1119,7 +2145,7 @@ function list(flags) {
       continue;
     found = true;
     if (flag(flags.check)) {
-      const missing = m.files.filter((f) => !existsSync7(f));
+      const missing = m.files.filter((f) => !existsSync12(f));
       console.log(`${label}: v${m.version} targets=${m.targets.join(",")} files=${m.files.length} missing=${missing.length} installed=${m.installedAt}`);
     } else {
       console.log(`${label}: v${m.version} targets=${m.targets.join(",")} files=${m.files.length} installed=${m.installedAt}`);
@@ -1128,6 +2154,178 @@ function list(flags) {
   if (!found)
     console.log("No mugiwara installation found.");
 }
+function continueCmd(flags, positionals) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const [mission, member] = positionals.slice(1);
+  let entries = readContinue(projectDir);
+  if (!flag(flags.all)) {
+    const actor = gitActor(projectDir);
+    const mine = entries.filter((e) => e.actor === actor);
+    if (mine.length)
+      entries = mine;
+  }
+  const r = resolveContinue(entries, mission, member);
+  if (r.kind === "resume") {
+    console.log(formatResume(r.entry));
+    const st = readState(projectDir).find((s) => s.mission === r.entry.mission && s.member === r.entry.member);
+    const stale = st ? stalenessLine(projectDir, st.base_sha) : null;
+    if (stale)
+      console.log(stale);
+    return;
+  }
+  if (r.kind === "none") {
+    console.log("No mission in flight. Start one with Flow 0 triage (mugiwara-orchestration).");
+  } else if (r.kind === "missions") {
+    console.log(`${new Set(r.entries.map((e) => e.mission)).size} missions in flight:
+`);
+    console.log(formatTable(r.entries));
+    console.log(`
+Pick one: mugiwara continue <mission> [member]`);
+  } else if (r.kind === "members") {
+    console.log(`Mission "${r.mission}" has ${r.entries.length} members in flight:
+`);
+    console.log(formatTable(r.entries));
+    console.log(`
+Pick one: mugiwara continue ${r.mission} <member>`);
+  } else if (r.kind === "unknown-mission") {
+    console.error(`No in-flight mission "${r.mission}". Known: ${r.known.join(", ") || "(none)"}`);
+  } else {
+    console.error(`Mission "${r.mission}" has no member "${r.member}". Known: ${r.known.join(", ")}`);
+  }
+  process.exit(2);
+}
+function statusCmd(flags) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const states = readState(projectDir);
+  if (!states.length) {
+    console.log("No mission state on disk.");
+    return;
+  }
+  const actor = flag(flags.all) ? null : gitActor(projectDir);
+  const rows = actor ? states.filter((s) => s.actor === actor).length ? states.filter((s) => s.actor === actor) : states : states;
+  for (const s of rows) {
+    const scope = s.member ? ` [${s.member}]` : "";
+    console.log(`${s.mission}${scope}`);
+    console.log(`  flow ${s.flow} · ${s.tasks_done}/${s.tasks_total} tasks · lane ${s.lane}${s.lane_rose ? " ⬆ ROSE" : ""}${s.lane_reason ? ` (${s.lane_reason})` : ""} · mode ${s.mode}`);
+    console.log(`  blockers ${s.blockers_open} · heal cycle ${s.heal_cycle}/${s.heal_max_cycles}${s.heal_halt ? " — HALT" : ""} · files touched ${s.files_touched}`);
+    if (s.budget)
+      console.log(`  tokens ${s.tokens_est}/${s.budget} (${s.budget_status})${s.delegate_due ? " · delegate due" : ""}`);
+    console.log(`  branch ${s.branch} · updated ${s.updated_at}`);
+    if (s.evidence.length)
+      console.log(`  evidence: ${s.evidence.join(", ")}`);
+  }
+}
+function runCmd(flags, positionals) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const name = positionals[1];
+  if (!name) {
+    console.error(`usage: mugiwara run <script> [args...]
+  scripts: ${RUNNABLE.join(", ")}`);
+    process.exit(1);
+  }
+  const code = runScript(name, positionals.slice(2), projectDir);
+  if (code !== 0)
+    process.exit(code);
+}
+function blameCmd(flags, positionals) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const path = positionals[1];
+  if (!path) {
+    console.error("usage: mugiwara blame <file-path>");
+    process.exit(1);
+  }
+  console.log(blamePath(projectDir, path));
+}
+function stalenessLine(projectDir, baseSha) {
+  if (!baseSha || baseSha === "unknown")
+    return null;
+  const git3 = (args) => {
+    try {
+      return execFileSync6("git", args, { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    } catch {
+      return "";
+    }
+  };
+  let main = "";
+  for (const ref of ["main", "master"]) {
+    main = git3(["rev-parse", "--verify", ref]);
+    if (main)
+      break;
+  }
+  if (!main)
+    return null;
+  try {
+    const behind = Number(git3(["rev-list", "--count", `${baseSha}..${main}`])) || 0;
+    return behind > 0 ? `⚠ stale base: main is ${behind} commit(s) ahead of this mission's base ${baseSha.slice(0, 7)} — rebase check before continuing` : null;
+  } catch {
+    return null;
+  }
+}
+function handoffCmd(flags, positionals) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const mission = positionals[1];
+  if (!mission) {
+    console.error("usage: mugiwara handoff <mission> [--project <dir>]");
+    process.exit(1);
+  }
+  const states = readState(projectDir).filter((s) => s.mission === mission);
+  if (!states.length) {
+    console.error(`no in-flight mission "${mission}"`);
+    process.exit(1);
+  }
+  const lines = [
+    `# Handoff: ${mission}`,
+    "",
+    `Generated ${new Date().toISOString()} by \`mugiwara handoff\`.`,
+    "",
+    "| | |",
+    "|---|---|"
+  ];
+  for (const s of states) {
+    const scope = s.member ? ` [${s.member}]` : "";
+    lines.push(`| Mission${scope} | flow ${s.flow}, tasks ${s.tasks_done}/${s.tasks_total}, lane ${s.lane}${s.lane_rose ? " (rose)" : ""}, mode ${s.mode} |`);
+    lines.push(`| Branch | \`${s.branch}\` |`);
+    lines.push(`| Actor | ${s.actor || "(unknown)"} |`);
+    if (s.next_action)
+      lines.push(`| Next action | ${s.next_action} |`);
+    if (s.blockers_open)
+      lines.push(`| Open blockers | ${s.blockers_open} |`);
+    if (s.heal_cycle)
+      lines.push(`| Heal cycles | ${s.heal_cycle}/${s.heal_max_cycles}${s.heal_halt ? " — HALTED" : ""} |`);
+    if (s.evidence.length)
+      lines.push(`| Evidence | ${s.evidence.join(", ")} |`);
+    const stale = stalenessLine(projectDir, s.base_sha);
+    if (stale)
+      lines.push(`| Staleness | ${stale.replace("⚠ stale base: ", "")} |`);
+  }
+  lines.push("", "## Resuming", "", `\`mugiwara continue ${mission}\` prints the exact resume point.`);
+  lines.push("Verify `next_action` against plan.md before executing — the table above is computed state, not judgement.");
+  const out = join15(".mugiwara", "missions", mission, "handoff.md");
+  writeFileSync8(resolve2(projectDir, out), lines.join(`
+`) + `
+`);
+  console.log(lines.join(`
+`));
+  console.log(`
+written: ${out}`);
+}
+function signCmd(flags, _) {
+  const projectDir = resolve2(str(flags.project) ?? process.cwd());
+  const mission = _[1];
+  if (!mission) {
+    console.error("usage: mugiwara sign <mission> [--verify] [--project <dir>]");
+    process.exit(1);
+  }
+  const missionDir = join15(projectDir, ".mugiwara", "missions", mission);
+  if (!existsSync12(missionDir)) {
+    console.error(`no mission dir: ${missionDir}`);
+    process.exit(1);
+  }
+  const r = flag(flags.verify) ? verifyReport(projectDir, missionDir) : signReport(projectDir, missionDir);
+  console.log(`${r.ok ? "✓" : "✗"} ${r.message}`);
+  if (!r.ok)
+    process.exit(1);
+}
 function help() {
   console.log(`mugiwara ${VERSION} — the Straw Hat crew for AI agents
 
@@ -1137,8 +2335,23 @@ Usage:
   mugiwara uninstall     remove installed files via manifest
   mugiwara list          show installations
   mugiwara list --check  health check: show installations + missing files
-  mugiwara reset         wipe mission state (spec/plans/results/review/issues[/logs])
-  mugiwara archive <m>    fold a closed mission's evidence into its report, then remove loose files
+  mugiwara reset         wipe mission state (missions/ + legacy dirs)
+  mugiwara archive <m>   fold a closed mission's waves into its report, then remove loose files
+  mugiwara clean [--all] [--before <date>]
+                         batch-archive every closed mission (report.md present, no live state)
+  mugiwara continue      list in-flight missions (exit 2 = pick one, nothing resumed)
+  mugiwara continue <m> [member]
+                         print the exact resume point for that mission/member
+  mugiwara status        computed mission state: wave, tasks, lane, blockers, budget
+  mugiwara blame <path>  provenance note on the last commit touching <path>
+                         (fetch notes first: git fetch origin 'refs/notes/mugiwara:refs/notes/mugiwara')
+  mugiwara handoff <m>   write .mugiwara/missions/<m>/handoff.md — a report the next
+                         engineer can act on (computed state + staleness check)
+  mugiwara sign <m>      optional attestation: minisign-sign report.md (--verify to check)
+  mugiwara run <script> [args...]
+                         run a bundled harness script here (${RUNNABLE.join(", ")})
+  mugiwara savepoint <mission> [member] [flow] [mode]
+                         shorthand for: mugiwara run savepoint.sh ...
   mugiwara --help        this help
   mugiwara --version     print version
 
@@ -1150,9 +2363,12 @@ Flags:
   --force                overwrite differing files (with backup)
   --dry-run              print actions without writing
   --check                with list: report missing files (health check)
-  --keep-logs            with reset: keep .mugiwara/logs (lessons ledger survives)`);
+   --all                  with continue/status: every actor; with clean: include in-flight missions
+   --force                with clean --all: archive in-flight missions anyway
+   --before <date>        with clean: also archive missions untouched since this date
+   --keep-logs            with reset: keep lessons.md (lessons ledger survives)`);
 }
-var isMain = process.argv[1] !== undefined && fileURLToPath4(import.meta.url) === resolve(process.argv[1]);
+var isMain = process.argv[1] !== undefined && fileURLToPath5(import.meta.url) === resolve2(process.argv[1]);
 if (isMain) {
   run(process.argv.slice(2)).catch((err) => {
     console.error(`mugiwara: ${err.message}`);
@@ -1160,5 +2376,6 @@ if (isMain) {
   });
 }
 export {
-  run
+  run,
+  stalenessLine
 };